On Fri, Jul 29, 2016 at 01:06:52PM -0600, John Nielsen wrote:
> Generally speaking, you can't bridge the station side of a wireless link. The
> access point will only accept frames with the station's MAC address. So what
> you are seeing is expected, unfortunately.
>
> Your best bet is probably to do NAT. Take lagg0 out of the bridge and use it
> as your "public" interface. Assign a local IP to the bridge. Run a DHCP
> server on your host (or in another VM on the bridge if you like) or just use
> static internal IPs on your VMs. Enable IP forwarding (gateway_enable=yes in
> rc.conf). Configure your firewall to NAT your private range out lagg0.
>
> You can do other things with tunneling, etc. but you'll need a remote
> endpoint for the tunnel. (If your access point runs FreeBSD you can use
> either vxlan or gif+EtherIP and just use the wireless link to carry the
> tunnel traffic, but I suspect that you want to roam between arbitrary access
> points.)

Thanks for the explanation, that makes perfect sense. I hadn't
considered the implications of a layer 2 bridge to a wireless link.